Lucene search

SynologyCVE-2022-43749

HistoryOct 26, 2022 - 10:15 a.m.

CVE-2022-43749

2022-10-2610:15:18

CWE-269

synology

web.nvd.nist.gov

cve-2022-43749

improper privilege management

synology presto file server

remote authenticated users

security constraint

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

29.6%

JSON

Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security constraint via unspecified vectors.

Affected configurations

Nvd

Node

synologypresto_file_serverRange<2.1.2-1601

VendorProductVersionCPE
synologypresto_file_server*cpe:2.3:a:synology:presto_file_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
synology	presto_file_server	*	cpe:2.3:a:synology:presto_file_server::::::::

CNA Affected

[
  {
    "vendor": "Synology",
    "product": "Presto File Server",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "2.1.2-1601",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

www.synology.com/security/advisory/Synology_SA_22_19

Social References

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

29.6%

JSON

Related for CVE-2022-43749